macOS: Only set entitlements for main binaries, fixing C# signing issues

[LeonardoDemartino]

This fixes #91469

[bruvzg]

That's fine for .dylibs but probably should be applied to .frameworks as well (same issue is likely relevant for GDExtensions).

Something like:

diff --git a/platform/macos/export/export_plugin.cpp b/platform/macos/export/export_plugin.cpp
index 2ff02d2e74..de145d431f 100644
--- a/platform/macos/export/export_plugin.cpp
+++ b/platform/macos/export/export_plugin.cpp
@@ -1092,7 +1092,7 @@ void EditorExportPlatformMacOS::_code_sign(const Ref<EditorExportPreset> &p_pres
 			List<String> args;
 			args.push_back("sign");
 
-			if (p_path.get_extension() != "dmg") {
+			if (!p_ent_path.is_empty()) {
 				args.push_back("--entitlements-xml-path");
 				args.push_back(p_ent_path);
 			}
@@ -1153,7 +1153,7 @@ void EditorExportPlatformMacOS::_code_sign(const Ref<EditorExportPreset> &p_pres
 				args.push_back("runtime");
 			}
 
-			if (p_path.get_extension() != "dmg") {
+			if (!p_ent_path.is_empty()) {
 				args.push_back("--entitlements");
 				args.push_back(p_ent_path);
 			}
@@ -1237,7 +1237,7 @@ void EditorExportPlatformMacOS::_code_sign_directory(const Ref<EditorExportPrese
 		}
 
 		if (extensions_to_sign.has(current_file.get_extension())) {
-			String ent_path = p_ent_path;
+			String ent_path;
 			bool set_bundle_id = false;
 			if (sandbox && FileAccess::exists(current_file_path)) {
 				int ftype = MachO::get_filetype(current_file_path);
@@ -1357,7 +1357,7 @@ Error EditorExportPlatformMacOS::_copy_and_sign_files(Ref<DirAccess> &dir_access
 			_code_sign_directory(p_preset, p_in_app_path, p_ent_path, p_helper_ent_path, p_should_error_on_non_code_sign);
 		} else {
 			if (extensions_to_sign.has(p_in_app_path.get_extension())) {
-				String ent_path = p_ent_path;
+				String ent_path;
 				bool set_bundle_id = false;
 				if (p_sandbox && FileAccess::exists(p_in_app_path)) {
 					int ftype = MachO::get_filetype(p_in_app_path);
@@ -2210,7 +2210,7 @@ Error EditorExportPlatformMacOS::export_project(const Ref<EditorExportPreset> &p
 				if (ep.step(TTR("Code signing DMG"), 3)) {
 					return ERR_SKIP;
 				}
-				_code_sign(p_preset, p_path, ent_path, false, false);
+				_code_sign(p_preset, p_path, String(), false, false);
 			}
 		} else if (export_format == "pkg") {
 			// Create a Installer.

This will also ensure the same is done with built-in ad-hoc signer (which is irrelevant for the issue, but is good for consistency).

[bruvzg]

Seems to be working fine for out of App Store exports.

Please squash the commits into one, see pull request workflow.

[akien-mga]

Thanks!

[TCROC]

This fixed it for me! Just cherry picked it into my fork! We were running into this issue with all of our gdextensions as well as additional macos frameworks such as godotsteam https://github.com/GodotSteam/GodotSteam

[akien-mga]

Cherry-picked for 4.3.1.